Is pimcore/pimcore 6.2 vulnerable?

Composer · 4 releases from 6.2.0 to 6.2.3 · latest pimcore/pimcore is 2026.3.3.1 · checked 1 Nov 2026

Yes: 118 known advisories

Yes. pimcore/pimcore 6.2.3, the last 6.2 release, is affected by 118 known security advisories (3 critical, 30 high, 85 medium), including CVE-2026-55634, CVE-2026-55220, CVE-2022-39365. 3 more affect earlier 6.2.x releases. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting pimcore/pimcore 6.2.3

  • HighCVE-2026-55416GHSA-23rh-xw42-fq8210 Sept 2026

    Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

    Affected
    >=2026.1.0 <2026.1.6 · >=12.0.0-RC1 <12.3.10 · <11.5.19
    Fixed in
    11.5.19, 12.3.10, 2026.1.6
  • CriticalCVE-2026-55634GHSA-9x44-4gxf-8c2528 Aug 2026

    Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

    Affected
    <12.3.10 · >=2026.1.0 <2026.1.6
    Fixed in
    12.3.10, 2026.1.6
  • CriticalCVE-2026-55220GHSA-w23p-wrp7-ch3828 Aug 2026

    Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

    Affected
    >=2026.1.0 <2026.1.6 · <12.3.10
    Fixed in
    12.3.10, 2026.1.6
  • HighCVE-2026-55072GHSA-2mhj-fhvg-v42813 Aug 2026

    Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

    Affected
    >=2026.1.0 <2026.1.5 · <12.3.9
    Fixed in
    12.3.9, 2026.1.5
  • HighCVE-2026-11407GHSA-7p36-fq2r-4h7r17 Jun 2026

    Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

    Affected
    >=12.0.0-RC1 <=12.3.8 · <=11.5.14.1
    Fixed in
    No fix released
  • HighCVE-2026-5394GHSA-r2f4-ff2p-xc6428 May 2026

    Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save

    Affected
    >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
    Fixed in
    11.5.17, 12.3.7, 2026.1.3
  • HighCVE-2026-45704GHSA-jwcc-gv4m-93x627 May 2026

    Pimcore has a CustomReports Share Bypass

    Affected
    >=12.0.0-RC1 <12.3.6 · <11.5.17 · >=2026.1.0 <2026.1.2
    Fixed in
    11.5.17, 12.3.6, 2026.1.2
  • MediumCVE-2026-45703GHSA-332x-r494-54fq27 May 2026

    Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export

    Affected
    >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
    Fixed in
    11.5.17, 12.3.7, 2026.1.3
  • HighCVE-2026-45260GHSA-wc7j-g8wx-m2qx27 May 2026

    Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

    Affected
    >=12.0.0-RC1 <12.3.7 · >=2026.1.0 <2026.1.3 · <11.5.17
    Fixed in
    11.5.17, 12.3.7, 2026.1.3
  • HighCVE-2026-45162GHSA-36fc-7wjg-mfvj27 May 2026

    Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

    Affected
    >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
    Fixed in
    11.5.17, 12.3.7, 2026.1.3
  • HighCVE-2026-44739GHSA-3234-gxc3-pq6f27 May 2026

    Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration

    Affected
    >=2026.1.0 <2026.1.2 · <11.5.17 · >=12.0.0-RC1 <12.3.6
    Fixed in
    11.5.17, 12.3.6, 2026.1.2
  • MediumCVE-2026-27461GHSA-vxg3-v4p6-f3fp24 Feb 2026

    Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause

    Affected
    <=11.5.14.1 · >=12.0.0 <12.3.3
    Fixed in
    12.3.3
  • MediumCVE-2026-23494GHSA-m3r2-724c-pwgf15 Jan 2026

    Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing

    Affected
    >=12.0.0-RC1 <12.3.1 · <11.5.14
    Fixed in
    11.5.14, 12.3.1
  • HighCVE-2026-23493GHSA-q433-j342-rp9h15 Jan 2026

    Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

    Affected
    >=12.0.0-RC1 <12.3.1 · <11.5.14
    Fixed in
    11.5.14, 12.3.1
  • HighCVE-2026-23492GHSA-qvr7-7g55-69xj14 Jan 2026

    Pimcore Has an Incomplete Patch for CVE-2023-30848

    Affected
    >=12.0.0-RC1 <12.3.1 · <11.5.14
    Fixed in
    11.5.14, 12.3.1
  • MediumCVE-2025-27617GHSA-qjpx-5m2p-5pgh11 Mar 2025

    Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

    Affected
    <11.5.4
    Fixed in
    11.5.4
  • HighCVE-2023-47637GHSA-72hh-xf79-429p15 Nov 2023

    Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()

    Affected
    <11.1.1
    Fixed in
    11.1.1
  • MediumCVE-2023-5873GHSA-j59v-hh4p-q92m31 Oct 2023

    Pimcore Cross-site Scripting vulnerability

    Affected
    <11.1.0
    Fixed in
    11.1.0
  • MediumCVE-2023-4453GHSA-599v-h3q5-g6r921 Aug 2023

    Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields

    Affected
    <10.6.8
    Fixed in
    10.6.8
  • MediumCVE-2023-38708GHSA-34hj-v8fm-x8873 Aug 2023

    Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction

    Affected
    <10.6.7
    Fixed in
    10.6.7
  • HighCVE-2023-3819GHSA-r87r-982q-2c3q21 Jul 2023

    Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

    Affected
    <10.6.4
    Fixed in
    10.6.4
  • HighCVE-2023-3820GHSA-c9hw-557q-f8hq21 Jul 2023

    Pimcore vulnerable to SQL Injection in Dataobjects sorting

    Affected
    <10.6.4
    Fixed in
    10.6.4
  • MediumCVE-2023-3821GHSA-78q2-cv3p-x9fm21 Jul 2023

    Pimcore Cross-site Scripting vulnerability

    Affected
    <10.6.4
    Fixed in
    10.6.4
  • MediumCVE-2023-3822GHSA-vmpv-qjhq-r46321 Jul 2023

    Pimcore Cross-site Scripting vulnerability

    Affected
    <10.6.4
    Fixed in
    10.6.4
  • HighCVE-2023-3673GHSA-rxp5-qwrf-pfv314 Jul 2023

    Pimcore SQL Injection vulnerability

    Affected
    <10.5.24
    Fixed in
    10.5.24
  • MediumCVE-2023-2984GHSA-46g3-f9r8-xj4v6 Jun 2023

    Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter

    Affected
    <10.5.22
    Fixed in
    10.5.22
  • MediumCVE-2023-2983GHSA-m4mv-rmr7-h5f56 Jun 2023

    Pimcore Privilege Defined With Unsafe Actions vulnerability

    Affected
    <10.5.23
    Fixed in
    10.5.23
  • MediumCVE-2023-2730GHSA-q3p4-v2cm-q94516 May 2023

    Pimcore Cross-site Scripting vulnerability

    Affected
    <10.3.3
    Fixed in
    10.3.3
  • MediumCVE-2023-2630GHSA-w766-3572-f2hv11 May 2023

    Pimcore Cross-site Scripting (XSS) vulnerability in Admin Translations

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2616GHSA-mhpj-7m7h-8p6x11 May 2023

    Pimcore Cross-site Scripting (XSS) in Static Routes name field

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2614GHSA-m6m9-gr85-79vm10 May 2023

    Pimcore Cross-site Scripting (XSS) in name field of Custom Reports

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2615GHSA-q7cc-m6jw-m26210 May 2023

    Pimcore Cross-site Scripting (XSS) in Predefined Properties delete

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-30855GHSA-g2mc-fqqc-hxg32 May 2023

    Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php

    Affected
    <10.5.18
    Fixed in
    10.5.18
  • MediumCVE-2023-2361GHSA-9xg6-75mh-7x3f1 May 2023

    Cross-site Scripting (XSS) in pimcore

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-30852GHSA-j5c3-r84f-959627 Apr 2023

    Arbitrary File Read in Admin JS CSS files

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2340GHSA-g93x-fm2w-5pxw27 Apr 2023

    Cross-site Scripting (XSS) in DataObject columns grid

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2339GHSA-6fvf-x8c6-2f6j27 Apr 2023

    Cross-site Scripting (XSS) in DataObject Any Getter grid operator

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2336GHSA-hg77-vx9v-f49x27 Apr 2023

    Path Traversal in Asset "import from server" option

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2332GHSA-r7mm-jx6h-hv7m27 Apr 2023

    Cross-site Scripting (XSS) in Conditions tab of Pricing Rules

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2328GHSA-2295-vh28-pphc27 Apr 2023

    Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2327GHSA-x9xj-pqmv-8jf727 Apr 2023

    Cross-site Scripting (XSS) in pimcore via DataObject Class date fields

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2323GHSA-cjv6-w5hf-5wr627 Apr 2023

    Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2322GHSA-476g-v7hf-cw5m27 Apr 2023

    Cross-site Scripting (XSS) in Document Properties Parameter

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • HighCVE-2023-2338GHSA-4x35-vr82-xvj627 Apr 2023

    SQL Injection in AssetController

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2342GHSA-2c67-p4xh-m34w27 Apr 2023

    Cross-site Scripting (XSS) in Website Settings name field

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2341GHSA-fq95-rx4q-qgg227 Apr 2023

    Cross-site Scripting (XSS) in Admin Login too many attempts notice

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2343GHSA-9q7q-r54q-3f3g27 Apr 2023

    Cross-site Scripting (XSS) in DataObject Classification Store

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • HighCVE-2023-30850GHSA-jwg4-qcgv-5wg627 Apr 2023

    SQL Injection in Admin Translations API

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • HighCVE-2023-30849GHSA-xmg8-w465-mr5627 Apr 2023

    SQL Injection in Translation Export API

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • HighCVE-2023-30848GHSA-6mhm-gcpf-5gr827 Apr 2023

    SQL Injection in Admin Search Find API

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-1703GHSA-4f25-2x2c-vg6v4 Apr 2023

    pimcore is vulnerable to cross-site scripting in Composite indices key field

    Affected
    <10.5.20
    Fixed in
    10.5.20
  • MediumCVE-2023-1701GHSA-7r35-chv4-xr3r31 Mar 2023

    Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

    Affected
    <10.5.20
    Fixed in
    10.5.20
  • MediumCVE-2023-1702GHSA-6qjm-39vh-729w31 Mar 2023

    Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings

    Affected
    <10.5.20
    Fixed in
    10.5.20
  • MediumCVE-2023-1704GHSA-hfmg-g39c-544431 Mar 2023

    pimcore is vulnerable to cross-site scripting in translate module

    Affected
    <10.5.20
    Fixed in
    10.5.20
  • MediumCVE-2023-28438GHSA-vf7q-g2pv-jxvx22 Mar 2023

    Pimcore vulnerable to improper quoting of filters in Custom Reports

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1578GHSA-42c3-wvww-gcqj22 Mar 2023

    Pimcore Remote Code Execution vulnerability in Search function

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-28429GHSA-rcg9-hrhx-6q6920 Mar 2023

    Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1515GHSA-66cm-c7ch-5j8q20 Mar 2023

    Pimcore vulnerable to Cross-site Scripting (XSS) in Redirects

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1517GHSA-42x8-2v53-pqmj20 Mar 2023

    Pimcore has Cross site Scripting vulnerability in Schedule tab of Documents

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • HighCVE-2023-28108GHSA-xc9p-r5qj-8xm917 Mar 2023

    Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-28106GHSA-x5j3-mq9g-8jc817 Mar 2023

    Cross-site Scripting (XSS) in UrlSlug Data type

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumGHSA-2xpm-cmvw-3jcc16 Mar 2023

    Reflected XSS in Application Logger module

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1429GHSA-3223-w774-99fq16 Mar 2023

    Cross-site Scripting (XSS) in Document Types

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumGHSA-rrwm-8wqm-gwgv16 Mar 2023

    Cross-site Scripting (XSS) - stored in Print Documents

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1312GHSA-gh4g-65f6-84g510 Mar 2023

    pimcore is vulnerable to cross-site scripting

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1286GHSA-8jv7-vwrc-mv4g9 Mar 2023

    Cross-site Scripting (XSS) in pimcore/pimcore

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1116GHSA-96hp-38wx-j3wc1 Mar 2023

    Pimcore vulnerable to Cross Site Scripting in Email Blacklist

    Affected
    <10.5.18
    Fixed in
    10.5.18
  • MediumCVE-2023-1117GHSA-qxcw-rf4v-hp261 Mar 2023

    Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config

    Affected
    <10.5.18
    Fixed in
    10.5.18
  • MediumCVE-2023-1115GHSA-97cp-8873-v2gf1 Mar 2023

    Pimcore vulnerable to Cross Site Scripting in Documents Link Editable

    Affected
    <10.5.18
    Fixed in
    10.5.18
  • MediumCVE-2023-1067GHSA-f2jh-mf2c-827827 Feb 2023

    Pimcore vulnerable to Cross-site Scripting

    Affected
    <=10.5.17
    Fixed in
    No fix released
  • MediumGHSA-76r7-h46w-463r15 Feb 2023

    Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug

    Affected
    <10.5.17
    Fixed in
    10.5.17
  • HighCVE-2023-25240GHSA-r2vq-p658-p27413 Feb 2023

    SameSite Attribute vulnerability in pimCore

    Affected
    <10.5.16
    Fixed in
    10.5.16
  • MediumCVE-2023-23937GHSA-8xv4-jj4h-qww62 Feb 2023

    Pimcore contains Unrestricted Upload of File with Dangerous Type

    Affected
    <10.5.16
    Fixed in
    10.5.16
  • MediumCVE-2023-0323GHSA-6vf6-g3pr-j83h20 Jan 2023

    pimcore is vulnerable to cross-site scripting via "title field " in data objects

    Affected
    <10.5.14
    Fixed in
    10.5.14
  • CriticalCVE-2022-39365GHSA-5qxq-vgmm-q39m29 Oct 2022

    RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

    Affected
    <10.5.9
    Fixed in
    10.5.9
  • MediumCVE-2022-3255GHSA-wqr6-57qm-hhr522 Sept 2022

    Pimcore vulnerable to cross site scripting

    Affected
    <10.5.7
    Fixed in
    10.5.7
  • MediumCVE-2022-3211GHSA-4849-x3jx-45qr16 Sept 2022

    Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new users

    Affected
    <10.5.6
    Fixed in
    10.5.6
  • MediumCVE-2022-2796GHSA-pr4f-4pcx-2r3h24 Aug 2022

    Pimcore Cross-site Scripting (XSS)

    Affected
    <10.5.4
    Fixed in
    10.5.4
  • HighCVE-2022-31092GHSA-gvmf-wcx6-p97422 Jun 2022

    Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore

    Affected
    <10.4.4
    Fixed in
    10.4.4
  • MediumCVE-2019-18982GHSA-m4x3-xmjv-r77824 May 2022

    Pimcore Cross-site Scripting (XSS) vulnerability

    Affected
    <6.3.0
    Fixed in
    6.3.0
  • MediumCVE-2019-18656GHSA-65p8-5423-fw3x24 May 2022

    Pimcore XSS Vulnerability

    Affected
    <6.3.0
    Fixed in
    6.3.0
  • HighCVE-2022-1429GHSA-2v7p-f4qm-r5pc23 Apr 2022

    SQL Injection found in Pimcore

    Affected
    <10.3.6
    Fixed in
    10.3.6
  • MediumCVE-2022-1351GHSA-xcr3-4qvr-54rh15 Apr 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4
    Fixed in
    10.4
  • HighCVE-2022-1339GHSA-mj2c-5mjv-gmmj14 Apr 2022

    SQL Injection in Pimcore

    Affected
    <10.3.5
    Fixed in
    10.3.5
  • HighCVE-2022-1219GHSA-6gm7-j668-w6h99 Apr 2022

    SQL Injection in Pimcore

    Affected
    <10.3.5
    Fixed in
    10.3.5
  • MediumCVE-2022-0911GHSA-j29f-m23h-3p8p17 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0704GHSA-pc32-x737-74cv17 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0705GHSA-xmq3-hgjx-699717 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0894GHSA-22hc-47cc-7x6f16 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0893GHSA-g795-4hxx-qqwm16 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0832GHSA-6qcc-whgp-pjj25 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.3.3
    Fixed in
    10.3.3
  • MediumCVE-2022-0831GHSA-q67f-3jq4-mww25 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.3.3
    Fixed in
    10.3.3
  • MediumCVE-2022-0665GHSA-gjq4-69wj-p6pr23 Feb 2022

    Path traversal in pimcore

    Affected
    <10.3.2
    Fixed in
    10.3.2
  • MediumCVE-2022-0565GHSA-h9vc-2p9g-63gp15 Feb 2022

    Cross-site Scripting in pimcore

    Affected
    <10.3.1
    Fixed in
    10.3.1
  • MediumCVE-2022-0509GHSA-cg3h-rc9q-g8v99 Feb 2022

    Cross-site Scripting in pimcore

    Affected
    <10.3.1
    Fixed in
    10.3.1
  • MediumCVE-2022-0510GHSA-mxh3-2699-98g99 Feb 2022

    Cross-site Scripting pimcore

    Affected
    <10.3.1
    Fixed in
    10.3.1
  • MediumCVE-2022-0348GHSA-8x44-pwr2-rgc628 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.10
    Fixed in
    10.2.10
  • MediumCVE-2022-0251GHSA-f7q6-xxph-mfm827 Jan 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.2.10
    Fixed in
    10.2.10
  • MediumCVE-2022-0260GHSA-455w-gv5p-wgg326 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • MediumCVE-2021-4146GHSA-54hw-mhgh-x4vc26 Jan 2022

    Business Logic Errors in pimcore

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • MediumCVE-2022-0257GHSA-v567-q267-phpg21 Jan 2022

    pimcore is vulnerable to Cross-site Scripting

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • HighCVE-2022-0258GHSA-vj9x-w7ch-f46p21 Jan 2022

    pimcore is vulnerable to SQL Injection

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • MediumCVE-2022-0256GHSA-57hg-26h7-9qgv21 Jan 2022

    pimcore is vulnerable to Cross-site Scripting

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • HighCVE-2022-0263GHSA-c697-r227-pq6h21 Jan 2022

    Unrestricted Upload of File with Dangerous Type in pimcore

    Affected
    <10.2.7
    Fixed in
    10.2.7
  • MediumCVE-2022-0262GHSA-4f5x-q4jc-xfcf21 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.7
    Fixed in
    10.2.7
  • MediumCVE-2022-0285GHSA-pm3v-qxf6-fgxv21 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • MediumCVE-2021-4139GHSA-8xx9-rxrj-2m2w5 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.7
    Fixed in
    10.2.7
  • MediumCVE-2021-4084GHSA-8w3x-r6x7-c5r516 Dec 2021

    Cross-site Scripting in pimcore

    Affected
    <10.2.6
    Fixed in
    10.2.6
  • MediumCVE-2021-4082GHSA-2v2v-fx7r-f2fh16 Dec 2021

    pimcore is vulnerable to Cross-Site Request Forgery (CSRF)

    Affected
    <10.2.6
    Fixed in
    10.2.6
  • MediumCVE-2021-4081GHSA-3p85-p4qg-hcrp16 Dec 2021

    pimcore is vulnerable to Cross-site Scripting

    Affected
    <10.2.6
    Fixed in
    10.2.6
  • MediumCVE-2021-39189GHSA-579x-cjvr-cqj920 Sept 2021

    Observable Response Discrepancy in Lost Password Service

    Affected
    <10.1.3
    Fixed in
    10.1.3
  • HighCVE-2021-39166GHSA-w6j8-jc36-x5q91 Sept 2021

    Improper Neutralization of Text-Values in Object Version Preview

    Affected
    <10.1.2
    Fixed in
    10.1.2
  • HighCVE-2021-39170GHSA-2v88-qq7x-xq5f1 Sept 2021

    Improper Encoding or Escaping of Output in Asset Metadata Component

    Affected
    <10.1.2
    Fixed in
    10.1.2
  • MediumCVE-2021-37702GHSA-pp2h-95hm-hv9r30 Aug 2021

    Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

    Affected
    <10.1.1
    Fixed in
    10.1.1
  • MediumGHSA-cfcv-q4qq-2ph423 Aug 2021

    CKEditor 4 vulnerabilities in versions <4.16.1

    Affected
    <10.1.1
    Fixed in
    10.1.1
  • HighCVE-2021-23405GHSA-g8jx-66p8-vcm213 Jul 2021

    SQL injection in pimcore/pimcore

    Affected
    <10.0.7
    Fixed in
    10.0.7
  • HighCVE-2021-23340GHSA-h7f9-cvh5-qw7f25 Feb 2021

    Path traversal in pimcore/pimcore

    Affected
    <6.8.8
    Fixed in
    6.8.8
  • MediumCVE-2019-10763GHSA-fpff-384j-vxq72 Dec 2019

    Data leakage via SQL Injection in Pimcore

    Affected
    <6.3.0
    Fixed in
    6.3.0

Fixed within 6.2.x, affecting earlier releases

  • CriticalCVE-2019-18985GHSA-hf62-5vxh-jpwj24 May 2022

    Pimcore 2FA Vulnerable to Brute Forcing

    Affected
    <6.2.2
    Fixed in
    6.2.2
  • CriticalCVE-2019-18981GHSA-jhcf-j4hg-v64r24 May 2022

    Pimcore Access Control Issues

    Affected
    <6.2.2
    Fixed in
    6.2.2
  • HighCVE-2019-18986GHSA-8889-9g3f-73rj24 May 2022

    Pimcore Discloses Usernames In Use

    Affected
    <6.2.2
    Fixed in
    6.2.2

Which of your client projects are still on pimcore/pimcore 6.2?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact pimcore/pimcore version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other pimcore/pimcore versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.